As used herein, “malicious computer code” is any code that enters a computer without an authorized user's knowledge and/or without an authorized user's consent. Malicious computer code that propagates from one computer to another over a network, e.g., via e-mail, is often referred to as a “worm”. Most worms that spread from one computer to another are spread via e-mail over the Internet. The most common way to send e-mail over the Internet is using the SMTP (Simple Mail Transfer Protocol). SMTP is part of TCP/IP (Transfer Control Protocol/Internet Protocol). SMTP was originally designed to send only that e-mail that consists solely of text and that is encoded using the ASCII character set, which is limited. It soon became apparent that computer users wished to send other than straight ASCII characters as e-mail, and so encoding schemes such as UUencode and MIME were developed. These encoding schemes are capable of encoding any type of file, including a binary graphics file, into ASCII so that it can be sent as an e-mail attachment.
FIG. 1 illustrates a common system by which a client computer 1 can send e-mail to a recipient computer 5 over an open network 4 such as the Internet. In FIG. 1, it is assumed that there are a plurality N of client computers 1 located within an enterprise 3. Enterprise 3 may be a company, a university, a government agency, etc. Computers 1 are coupled to each other and to an e-mail server computer 2 over a Local Area Network (LAN) 6. E-mail server 2 collects and formats e-mails sent from computers 1 and sends them to the designated recipients 5 using the SMTP protocol. It is assumed that there are a plurality J of recipient computers.
FIG. 2 illustrates a similar network in which client computers 1 are not associated with the same enterprise 3, but rather may be more geographically dispersed and are subscribers to an Internet Service Provider (ISP). In this case, computers 1 communicate with the ISP's e-mail server 2 via the Public Switched Telephone Network (PSTN) 6. In other respects, the functioning of the networks illustrated in FIGS. 1 and 2 are the same.